Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-47781 | SOL-11.1-010040 | SV-60657r1_rule | Medium |
Description |
---|
Enabling the audit system will produce records with accurate time stamps, source, user, and activity information. Without this information malicious activity cannot be accurately tracked. |
STIG | Date |
---|---|
Solaris 11 X86 Security Technical Implementation Guide | 2015-12-07 |
Check Text ( C-50237r1_chk ) |
---|
The Audit Configuration profile is required. This check applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. Check the status of the audit system. It must be auditing. # pfexec auditconfig -getcond If this command does not report: audit condition = auditing this is a finding. |
Fix Text (F-51401r1_fix) |
---|
The Audit Control profile is required. This action applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this action applies. If auditing has been disabled, it must be enabled with the following command: # pfexec audit -s |